Last Updated: March 2025

Introduction

Welcome to Tangram ("we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services. We are committed to protecting your privacy and ensuring transparency about how we handle your personal information. This Privacy Policy describes our practices in accordance with the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA").

By using our services, you agree to the collection and use of information in accordance with this Privacy Policy.

Notice at Collection

Upon collecting your personal information, we will provide notice explaining what data is being collected, the purposes for which it is used, and your rights to access, delete, correct, or opt out of data sales or sharing. This notice will be provided at or before the time of collection.

1. Categories of Personal Information We Collect

We collect information that identifies, relates to, describes, or is reasonably capable of being associated with, or could reasonably be linked (directly or indirectly) with you or your household, including the following categories of personal information:

• Identifiers: Name, email address, postal address, phone number.
• User Content: Data you enter into our service, including text inputs, photos, and other content.
• Internet or Other Electronic Network Activity Information: IP address, browser type, operating system, and browsing history on our website.
• Usage Data: Information about how you use our services.
• Geolocation Data: If you choose to provide location-related information.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience, analyze website performance, and provide personalized services. These technologies help us understand how users interact with our services, remember user preferences, and improve the overall functionality of our site. You can manage cookie preferences through your browser settings. For more information about how we use these technologies, please contact us using the methods listed in the "Contact Us" section.

We do not collect sensitive personal information as defined by the CPRA, except as you may voluntarily provide or authorize through our services.

2. How We Use Information

We use your personal information for the following business and commercial purposes:

• To Provide and Maintain Our Service: Including processing transactions and providing customer support.
• To Improve User Experience: Analyzing usage to enhance user experience, troubleshoot issues, and develop new features.
• To Communicate With You: Sending updates, newsletters, marketing communications, and responding to your inquiries.
• Legal Compliance: Complying with applicable laws, regulations, and legal processes.
• Security and Fraud Prevention: Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity.

3. Collection and Use of Photos

We collect and store photos that you upload to our service. While we do not currently encrypt the data stored on our servers, we implement other technical and administrative safeguards to protect your information. These may include restricted access controls, firewalls, intrusion detection systems, and regular security monitoring to help reduce the risk of unauthorized access, use, or disclosure. By uploading photos, you acknowledge and accept the inherent risks associated with transmitting information over the internet.

4. Third-Party Services

Tangram's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, outlined here: Google API Services User Data Policy.

5. How We Share Your Information

We may share your personal information with:

• Service Providers: Third-party vendors who assist in providing our services (e.g., hosting providers, analytics services), who are contractually obligated to keep this information confidential and use it only to perform services on our behalf.
• Legal Authorities: If required by law, regulation, or legal process, or if we believe disclosure is necessary to protect our rights or comply with a legal obligation.
• Business Transfers: In connection with any merger, sale, or transfer of assets, provided that the recipient agrees to protect your personal information consistent with this Privacy Policy.

We do not sell or share your personal information, as defined under the CCPA/CPRA, to third parties for monetary consideration or for cross-context behavioral advertising.

6.Data Protection Impact Assessments (DPIA)

As part of our commitment to protecting the privacy and rights of individuals, we conduct Data Protection Impact Assessments (DPIAs) when engaging in high-risk processing activities, such as processing sensitive personal data, using new technologies, or engaging in large-scale processing operations.

If our processing activities are deemed likely to result in high risks to the rights and freedoms of individuals, we will assess the necessity and proportionality of the processing, evaluate the risks, and implement measures to mitigate those risks.

Our DPIA process involves:

• Identifying and evaluating risks associated with data processing activities.
• Implementing safeguards to mitigate identified risks.
• Consulting with data protection authorities if necessary.
• Documenting DPIA outcomes and retaining records for compliance purposes.

If you have any questions or concerns about our DPIA process, please contact us using the information provided in the "Contact Us" section below.

7. Your Rights Under California Law

California residents have the following rights:

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, as well as the categories of sources, the purposes for which we collected the information, the categories of third parties to whom we disclosed personal information, and the categories of personal information that we disclosed.
• Right to Delete: You have the right to request that we delete personal information that we have collected from you, subject to certain exceptions.
• Right to Correct: You have the right to request that we correct inaccurate personal information that we hold about you.
• Right to Opt-Out of Sale/Share: We do not currently sell or share your personal information for cross-context behavioral advertising. If our practices change in the future, you will be provided with a clear and conspicuous method to opt-out before any such activity begins.
• Right to Limit Use and Disclosure of Sensitive Personal Information: If we ever collect sensitive personal information, you have the right to limit our use and disclosure of that information to uses permitted by law.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

8. Exercising Your Rights

To exercise your rights described above, please contact us using one of the following methods:

• Email: support@tangram.co
• Postal Mail: 56 Westfield St., West Haven, CT
• Phone: 203-306-7643

We may need to verify your identity before processing your request. Please provide sufficient information to allow us to verify your identity and understand the scope of your request. We will respond to verifiable requests as required by applicable law.

Authorized Agents

If you use an authorized agent to make a request on your behalf, we require the following:

• The authorized agent must provide written permission from you, or you must directly confirm with us that you've authorized the agent to act on your behalf.
• We may also require the agent to provide proof of their identity and your identity for verification.
• If your agent has a valid power of attorney under California law, we will not require additional proof of authorization.

Data Subject Access Requests (DSAR)

If you wish to exercise any of your rights related to your personal data under applicable laws (e.g., CCPA/CPRA, GDPR), including the right to access, delete, correct, restrict, or object to the processing of your personal data, you can make a Data Subject Access Request (DSAR) by contacting us using the details provided below.

To ensure your privacy and security, we may need to verify your identity before processing your DSAR request. Please provide sufficient information to allow us to verify your identity and understand the scope of your request. If you use an authorized agent to submit a DSAR on your behalf, we may require written authorization from you and verification of both your and the agent’s identities.

Once we have verified your identity, we will respond to your request within **30 days** (or the time frame required by applicable law). If additional time is needed, we will inform you of the delay and provide an estimated response time.

9. Retention of Personal Information

We retain your personal information for as long as it is necessary to fulfill the purposes for which it was collected or to comply with legal obligations, resolve disputes, or enforce our agreements.

10. Security

We implement reasonable security measures to protect your information via industry standard methods (SSL, Encryption, etc.). While no method of transmission or storage is completely secure, we are committed to taking appropriate steps to safeguard your personal information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be effective when we post the revised policy.

11. Contact Us

If you have any questions, please contact us at:

• Email: support@tangram.co
• Postal Mail: 56 Westfield St., West Haven, CT
• Phone: 203-306-7643

California Shine the Light Law

Under California Civil Code Section 1798.83, California residents can request information about sharing their personal information with third parties for direct marketing purposes. We do not share personal information with third parties for this purpose.

Do Not Track Signals

Our website does not respond to "Do Not Track" signals.

Minors

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal information from minors.

By using our services, you consent to our collection and use of your personal information as described in this Privacy Policy.